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Security proofs of quantum key distribution (QKD) systems usually assume that the users have 
access to source of perfect randomness. State-of-the-art QKD systems run at frequencies in the 
GHz range, requiring a sustained GHz rate of generation and acquisition of quantum random num¬ 
bers. In this paper we demonstrate such a high speed random number generator. The entropy 
source is based on amplified spontaneous emission from an erbium-doped fibre, which is directly 
acquired using a standard small form-factor pluggable (SFP) module. The module connects to the 
Field Programmable Gate Array (FPGA) of a QKD system. A real-time randomness extractor is 
implemented in the FPGA and achieves a sustained rate of 1.25 Gbps of provably random bits. 


I. INTRODUCTION 

Proposed in 1984, quantum key distribution (QKD) is 
a cryptographic technique that allows two spatially sep¬ 
arated users, called Alice and Bob, to exchange secret 
key via a potentially insecure quantum channel. A key 
advantage of QKD is that it offers provably secure cryp¬ 
tographic keys, while classical key distribution schemes 
can only offer computational security. Nowadays, own¬ 
ing to the significant progress made in photonics tech¬ 
nology, QKD experiments are able to distribute large 
secret keys at high repetition rates [1-4]. Among the 
many developments required for a fast QKD system, is 
the development of a fast and practical random number 
generator where the randomness is derived from quan¬ 
tum processes [5-14]. However, the integration of these 
fast quantum random number generators (QRNGs) with 
fast QKD systems has remained elusive, mainly due to 
the technical challenges in acquiring high data rates and 
certifying that the generated numbers are truly random. 
Moreover, the development of random number genera¬ 
tor based on physical source of randomness is useful for 
the classical cryptography protocols too. All the recent 
social events have demonstrated that cryptography pro¬ 
tocols using a pseudo-random number generators is not 
at all secure [15]. 

In this paper, we demonstrate how a fast quantum 
random number generator can be easily created and in¬ 
tegrated into a communication system. In our device, 
random numbers are generated by a source of ampli¬ 
fied spontaneous emission (ASE) and acquired by a field- 
programmable gate array (FPGA) using a standard small 
form-factor pluggable (SFP) module. This allows us to 
generate true random numbers at a rate of 1.25 Gbit/s, 
as required by state-of-the-art QKD systems. In the fol¬ 
lowing, we first describe the physical origin of the ran¬ 
domness that our random number generation is based on. 
Then, we sketch the experimental setup and detail how 
each element affects the randomness of our data-stream. 
Finally, we present our results, the amount of generated 
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FIG. 1: Experimental setup, composed of an amplified 
spontaneous emission (ASE) source, a filter, an SEP 
module and an EPGA. The ASE source consists of a 
back-pumped erbium doped fibre (EDE) emitting at 
1530 nm. The emitted light is filtered with a bandpass 
filter (50 GHz DWDM) and sent to the SEP module. 

This module consists of an avalanche photodiode 
(APD), which is further amplified by a transimpedance 
amplifier (TIA). The signal is then “digitised” by a 
limiting amplifier (LA) and sent on as a differential pair 
to the EPGA. The EPGA’s receiver (RX) deserializes 
the bitstream, using a stable sample clock (CLK) and 
passes it to the randomness extractor. Einally, the 
extracted numbers can be used by the quantum key 
distribution system. 


entropy and how it can be efficiently extracted. 


II. SETUP OF RANDOM NUMBER 
GENERATOR 


The experimental setup is simple and compact, in that 
it is constructed with standard telecommunications com¬ 
ponents, as shown in FIG. 1. The randomness source 
is based on a filtered ASE source followed by a small 
form-factor pluggable (SFP) module plug to a field- 
programmable gate array (FPGA). Below we describe 
these elements, analyzing the sources of randomness and 
of error. 
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A. Source ASE 

The generation of quantum random numbers using 
ASE has been described in detail in [16]. Here we 
briefly review this method, for an ASE source based on 
a pumped Erbium doped fibre. 

Erbium doped fibers are employed to realize telecom¬ 
munication wavelength amplifiers. Eor that, a pump laser 
at 980 nm excites the erbium atoms, which are homoge¬ 
neously distributed over the fiber. This constitutes a gain 
medium, such as used in erbium-doped fibre amplifiers 
(EDEAs). Each excited atoms has an equal probability 
of decaying. As shown in Eig. 2, depending on the posi¬ 
tion of this atom along the fibre, the photon will travel 
a length L in the gain medium before it reaches the end 
of the doped fibre. During this journey, the photon will 
stimulate the emission of a number of photons propor¬ 
tional to the exponential of L. This results in a very 
large distribution of output powers, described by Bose- 
Einstein statistics: 

PBE(n,n) := (1) 

where P^^{n^n) is the probability of finding n photons 
in one mode which is populated by n photons on aver- 
age [17], 



Atom i 


EIG. 2: In an erbium-doped fibre, atoms have an equal 
probability of emitting a photon at any point along the 
fibre. This photon will be amplified exponentially with 
the distance travelled before exiting the doped fibre. 


EIG. 3 shows this distribution for a mean number n = 
1000 photons/mode. This distribution is broad, so that 
a random number can be generated by looking whether 
the instantaneous intensity is above or below a specific 
threshold. To certify that the collected entropy is mostly 
of quantum origin, it is important that the photocurrent 
distribution is much broader than the distribution due to 
electrical (classical) noise. A practical source of ASE will 
output approximately n = 1000 photons/mode equiva¬ 
lent to 600 nW in a 2.5 GHz bandwidth, or —32 dBm, 
which is close to the noise level of receivers using an 
avalanche photodiode (APD). It is possible to send a 
higher number of modes onto the APD, i.e. choose an 
optical signal with a spectral bandwidth larger than the 
detector bandwidth by a factor m. The average number 



EIG. 3: Bose-Einstein photon number distribution for a 
single-mode field. This distribution is large, so that 
when discriminated by a threshold, the generated bit, 0 
or 1, will depend on this distribution rather than on 
electrical noise. 


of photons will then grow by a factor m, and the standard 
deviation, which is the value of interest to us, will grow 
by a factor ^/m. In this case, the intensity distribution 
is described by [17]: 

( 2 ) 

This distribution is plotted in EIG. 4 for a number of 
modes m = 1,10 and 40. As shown in this graph, using 
a higher number of modes makes the distribution more 
symmetric, which reduces bias, and increases it’s stan¬ 
dard deviation, which makes detection easier. 



EIG. 4: Normalized photon number distribution of a 
thermal state with a mean photon number of 1000, and 
a number of modes M = 1,10,40 respectively. As the 
number of modes grows, so does the standard deviation 
of the distribution. A larger number of modes also 
results in a more symmetric distribution. 
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For our source, we employed 1 m of erbium doped fibre 
(Thorlabs: ER30-4/125). The 980 nm pump laser output 
of 600 mW is sufficiently strong to saturate the medium, 
which allows to achieve a spectral radiance of the order of 
1000 photons/mode ,equivalent to that of a 30dB ampli¬ 
fier, and equivalent to ^ 10 fiW in a 50 GHz bandwidth. 
The spectral radiance of the source was calibrated using 
a fibre-based radiometer [18], and is perfectly stable on 
a long timescale (milliseconds to hours) [19]. 


B. Detection 

Detection is carried out by the APD receiver of an SFP 
(FTRJ1621P1BCL) module. As presented in FIG. 1, 
the InGaAs APD cathode is directly connect to a trans¬ 
impedance amplifier (TIA). At the output of the TIA, the 
signal is AC coupled to a limiting amplifier (LA) which 
generate the data coded as a voltage, 400 mV and - 400 
mV corresponding to a bit 1, and 0, respectively. More 
precisely, for a signal greater (smaller) than the average 
the LA delivers a voltage of 400 mV (-400 mV). This sig¬ 
nal could be directly plug to an FPGA to perform the 
post-processing. 

The module works at a bandwidth of 2.5 GHz, which 
fixes at 40 the number of modes received by the detectors. 
With equation (2), the standard deviation of the number 
of photons arriving on the sensor is ap = 6246, with a 
mean value of 40000 (see FIG. 4). The equivalent photon 
noise introduced by the detector and the electronics is 
an = 610, which is one order of magnitude smaller than 
the standard deviation of the light. 


III. CHARACTERIZATION AND RESULTS 

First, we estimate the probability of obtaining a zero or 
a one. In our configuration, the SFP automatically sets 
the threshold for the discrimination with an AC coupled 
limiting amplifier. To ensure that the discriminator does 
not move during the time and consequently change the 
statistic of our RNG, we acquired 4 x 10^ blocks of 512 
successive bits over a period of two days. For each block, 
the number of bits 0 are counted, to construct the prob¬ 
ability histogram reported in FIG. 5 (blue dots). More 
precisely, we expect the probability to obtain k zeros in a 
string of n bits to be given by the Binomial distribution 

where Pq the probability to obtain a bit 0. This func¬ 
tion is represented by a red line in the FIG. 5, with 
Pq = 0.4920 given by the mean value of the measured 
data. The standard dev iation of the function is given 
by (Jt = y/nPo(l — Pq) = 11.31, which is close to the 
measured value ctm = 11.68(1). Roughly speaking, this 



FIG. 5: Histogram representing the probability to 
obtain zeros in a block of 512 element for 4 x 10^ 
blocks. The red curve represent the statistical spread 
due to the small sample size predict by the equation 
(3). The insert represents the same curves in log scale. 
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FIG. 6: Auto-correlation coefficient computed for a raw 
and extracted sequences of 1.25 Gbits. The green line 
represent the standard deviation of the correlation due 
to the finale size of the sample. 


shows that the underlying distribution is well approx¬ 
imated by a Binomial distribution. In conclusion, the 
probability to obtain 0 or 1 is not equiprobable—this is 
due to the slight misalignment on the threshold position. 
However, note that the threshold position is stable over 
the acquisition time. Indeed, if the threshold position 
is not stable, or if the power of the source changes dur¬ 
ing the acquisition time, then this may lead to a broader 
distribution. 

Next, we compute the autocorrelation function, which 
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measures the serial correlation within a data sample. 


m 


{XqXj) - {Xo){Xj) 
^((X2)-(Xo)2)((X|)-(X,P)’ 


(4) 


where (•) denotes the proportion of ones, and Xq and Xj 
represent a bit string X[0,n] and X[j,n+j], respectively. 
The red curve in FIG. 6 represent this function obtain for 
a string of 1.25 x 10^ successive bits. The correlations are 
not negligible, therefore we cannot model the data with 
an iid (independent and identically distributed) process. 
To get a bound on the min-entropy of the source, we con¬ 
sider a Santha-Vazirani type of weak source of random¬ 
ness [20, 21], which generates a sequence of weak random 
bits where the probability distribution of each bit, con¬ 
ditioned on the previously generated bits, is bounded by 
some fixed real parameter 0 < (5 < 1/2. In particular, 
let the Xi,X 2 ,... be a sequence of n random bits 
generated by the Santha-Vazirani source, then for each 
0 < i < n 


6 < P{Xi-^i — Xi-^i\Xi — ..., Xi — xi) < 1 — (5. (5) 

For this type of source, the min-entropy is bounded by 
^min(Xi... > —log 2 ((l — Here, it is important 

to note that the min-entropy measures the number of 
extractable random bits from the sequence of n weakly 
random bits. 

One approach to estimate the value of 6 consists in us¬ 
ing the correlation coefficient. The stronger correlation is 
obtained for j = 1 with R(l) = 0.13078 and all the other 
is at least one order of magnitude smaller. With the cor¬ 
relation coefficient, we calculate the mutual information 
given by /(Xi,V 2 ) = ^ In (l — R(l)^), and the condi¬ 
tional entropy i7(Xi I Vo) = i7(Vo) —/(Vq, W) =0.9912 
for Pq estimate in the previous section. To estimate the 
min-entropy, we compute the greatest conditional prob¬ 
ability satisfying the conditional entropy defined in pre¬ 
vious equation, which corresponds to max{P{xi\xo)) = 
0.5775 and 6 = 0.4225. This approach allows to correctly 
estimate the bound of the min-entropy for n=2, but for 
n > 2 we assume that only two successive bits are corre¬ 
lated. 

To improve the estimation of J, we can calculate the 
conditional probability when we know more bits, which 
is given by 

Pi^Xi — Xi\X\ — X\ —1 — ^2—i) 

P{^X\ — X\ —1 — Xi—\^Xi — x^) 

P{Xi = Xi...w_i = Xi-i) 

The maximum conditional probability as function of i 
obtained by this method is shown in FIG. 7 a). These 
values are calculated from a string of 5 x 10^ bits. We 
can remark that the estimation of 6 with the previous 
method is not accurate for i > 2. Furthermore, with 
this approach, for i large, the error introduced by the 
finite size of the sample used to estimate the conditional 


a) 

5 = 0.4114 - 0.5000 - Extracted • 

0.4225 Raw 



b) 

5 = 0.4114 - 0.5000 - Extracted • 

0.4225 Raw • 



FIG. 7: a) Maximal conditional probability measures 
from 5 X 10^ bits as the function of the number of 
known bits, b) Min-entropy as a function of the string 
length i. 


probability are no longer negligible. More precisely, for i 
larger than 10 the results are not conclusive. For i=10, 
we obtain 5 = 0.4114. 

To verify if the estimation the estimation of delta 
is correct, we compute the min-entropy of 5 Gbit 
for different string size n, i.e. H^i^{Xi ... X^) = 

—log 2 (max(P(Vn...Vo)), as show the FIG. 7 b). More¬ 
over, the lines represent the min-entropy value for two 
different S. For S = 0.4225, 1C is greater than the 
computed Pmin the large n, which is not the case for 
5 = 0.4114. As shown FIG. 6, the correlation coefficient 
after 20 bits are the order of 10“^, we could assume the 
5 = 0.4114 verify the equation (5) Vn. 

To improve the min-entropy per bit, an extractor is 
implement in the FPGA based bit-matrix-vector multi¬ 
plication with a random matrix [22, 23]. The extractor 
uses raw sequence of 512 bits to generate 256 extracted 
bits, by multiplying the raw sequence with the random 
matrix of size 512 x 256 generated by a QRNG Quantis. 
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FIG. 8: Dieharder test of the data at the output of the 
extractor. For each test the represented p-value is the 
result of a Kolmogorov-Smirnov test of 100 p-values. To 
pass the test the p-value needs to satisfy 
0.01 <p< 0.99 [24]. 


In principle, with the min-entropy of the physical random 
generator, we could generated at least 391 bits per cycle. 
We choose to generate only 256 bits per cycle to obtain a 
frequency of 1.25 GHz. Moreover, a greater compression 
factor ensure the generation of a near perfect random bit 
string. 

To characterize the randomness of the extracted bit 
string, we first calculated the probability to obtain a bit 


0 after 1 s of measurement, Pq = 0.500001(15). Then, 
we computed as for the raw data the autocorrelation co¬ 
efficient, the conditional probability and the min-entropy 
(see FIG. 6 and 7). As shows all these measurements con¬ 
firm the good randomness of the bits after the extractor. 
Moreover, the FIG. 8 present some test results obtained 
with the extracted data. Note that, all the Diehard tests 
are successfully passed. 

IV. CONCLUSION 

In this paper we present a random number generator 
based on the statistics of a ASE source implemented in 
an erbium doped fibre. In addition to the completely 
fibered source of light, our generator takes advantage of 
a SFP module and an FPGA which makes compact, in¬ 
trinsically stable, and standalone. Indeed, the implemen¬ 
tation of all the post-processing inside the FPGA allows 
us to generate a random data flow of 1.25 Gb/s in real 
time. Our proposal has the benefit that it can be easily 
upgraded to a higher throughput, e.g., 10 Gbit/s simply 
by using a faster “SFP+” module. 

This generator is an excellent candidate to generate the 
random numbers necessary during the implementation of 
commercial quantum key distribution based on protocols 
such as COW or BB84. 

ACKNOWLEDGEMENT 

This work was supported by the Swiss NCCR QSIT. 


[1] Y. Liu, T.-Y. Chen, J.-H. J. Wang, W.-Q. Cai, X. Wan, 
L.-K. Chen, S.-B. Liu, H. Liang, L. Yang, C.-Z. Peng, 

K. Chen, Z.-B. Chen, and J.-W. Pan, Opt. Express 18 , 
8587 (2010). 

[2] S. Wang, W. Chen, J.-F. Guo, Z.-Q. Yin, H. W. Li, 
Z. Zhou, G.-C. Guo, and Z.-F. Han, Opt. Lett. 37 , 1008 
( 2012 ). 

[3] N. Walenta, A. Burg, D. Caselunghe, J. Constantin, 
N. Gisin, O. Guinnard, R. Houlmann, P. Junod, B. Ko- 
rzh, N. Kulesza, M. Legre, C. W. Lim, T. Lunghi, 

L. Monat, C. Portmann, M. Soucarros, R. T. Thew, 
P. Trinkler, G. Trolliet, F. Vannel, and H. Zbinden, New 
J. Phys. 16 , 013047 (2014). 

[4] K. A. Patel, J. F. Dynes, M. Lucamarini, 1. Choi, A. W. 
Sharpe, Z. L. Yuan, R. V. Penty, and A. J. Shields, Appl. 
Phys. Lett. 104 , 051123 (2014). 

[5] 1. Kanter, Y. Aviad, 1. Reidler, E. Cohen, and M. Rosen- 
bluh, Nat. Photon. 4, 58 (2009). 

[6] P. Li, Y.-C. Wang, and J.-Z. Zhang, Opt. Express 18, 
20360 (2010). 

[7] X. Li, A. B. Cohen, T. E. Murphy, and R. Roy, Opt. 
Lett. 36, 1020 (2011). 

[8] M. Wahl, M. Leifgen, M. Berlin, T. Rohlicke, H.-J. Rahn, 
and O. Benson, Appl. Phys. Lett. 98, 171105 (2011). 

[9] T. Symul, S. M. Assad, and P. K. Lam, Appl. Phys. 
Lett. 98 , 231103 (2011). 


[10] J. Zhang, Y. Wang, M. Liu, L. Xue, P. Li, A. Wang, and 
M. Zhang, Opt. Express 20 , 7496 (2012). 

[11] R. M. Nguimdo, G. Verschaffelt, J. Danckaert, X. Lei- 
jtens, and G. Van der Sande, Opt. Express 20 , 28603 
( 2012 ). 

[12] F. Xu, B. Qi, X. Ma, H. Xu, H. Zheng, and H.-K. Lo, 
Opt. Express 20 , 12366 (2012). 

[13] F. Lozach, M. Ben-Romdhane, T. Graba, and J.-L. Dan¬ 
ger, 2013 Euromicro Conference on Digital System De¬ 
sign , 615 (2013). 

[14] C. Abelian, W. Amaya, M. Jofre, M. Curty, a. Acm, 
J. Capmany, V. Pruneri, and M. W. Mitchell, Opt. Ex¬ 
press 22 , 1645 (2014). 

[15] G. Markowsky, Journal of Cyber Security and Mobility 
3 , 1 (2014). 

[16] C. R. S. Williams, J. C. Salevan, X. Li, R. Roy, and 
T. E. Murphy, Opt. Express 18, 23584 (2010). 

[17] W. S. Wong, H. A. Haus, L. A. Jiang, P. B. Hansen, and 

M. Margalit, Opt. Lett. 23 , 1832 (1998). 

[18] T. Lunghi, B. Korzh, B. Sanguinetti, and H. Zbinden, 
Opt. Express 22 , 18078 (2014), arXiv:1404.3486vl. 

[19] F. Monteiro, T. Guerreiro, B. Sanguinetti, and 
H. Zbinden, Appl. Phys. Lett. 103, 051109 (2013). 

[20] M. Santha and U. V. Vazirani, Journal of Computer and 
System Sciences 33 , 75 (1986). 





































6 


[21] M. Plesch and M. Pivoluska, Phys. Lett. A 378 , 2938 
(2014), 1305.0990. 

[22] M. Troyer and R. Renner, “A randomness extractor for 
the quantis device,” (2012). 


[23] D. Frauchiger, R. Renner, and M. Troyer, 
arXiv: 1311.4547 (2013), arXiv:1311.4547vl. 

[24] M. M. Alani, International Journal of Computer Science 
and Network Security 10 , 53 (2010). 



